Which statement correctly reflects penalties for SAR confidentiality breaches?

• A. Civil penalties up to $100,000 per violation
• B. There are no penalties
• C. Only civil penalties apply
• D. Penalties apply only to users outside the institution

Answer: (A)

Penalties for SAR confidentiality breaches come from the strict requirement to keep SAR information confidential. When someone discloses SAR details without authorization, civil penalties can be imposed, and the amount can reach up to $100,000 for each violation. This reflects how seriously the confidentiality rule is enforced and how each improper disclosure is treated as its own potential penalty.

This fits because there are penalties, so saying there are none is incorrect. The framework can involve more than just civil penalties—willful or intentional disclosures can also lead to criminal penalties—so it’s not accurate to say only civil penalties apply. And penalties can be imposed on internal users as well as external ones, so it isn’t correct to say penalties apply only to users outside the institution.